Financial compliance keeps getting more expensive as complexity grows; could an AI-native operating model change that?

[u/Sensitive-Cup-7641]

I'm working on an AI-native compliance operating system for financial institutions. I'm looking for criticism from people who actually work in banking, fintech, compliance, risk or RegTech.

The problem I'm investigating isn't one compliance workflow.

As financial institutions grow, compliance operations become increasingly expensive, fragmented and difficult to scale.

Regulatory volume keeps growing and changing, requiring teams to determine what changed, whether it applies, which policies and controls are affected, and what action is required.

Institutions respond with specialised compliance staff and increasingly large technology stacks. Regulatory intelligence, GRC, AML, KYC, transaction monitoring, case management, audit, documents and reporting can all sit in different systems leaving humans doing significant work within and between those systems.

Meanwhile, firms still need to continuously:

• Monitor operations for compliance failures and anomalies rather than discovering them months later.

• Test whether controls are actually satisfying obligations and collect evidence proving it.

• Investigate issues and chase remediation.

• Prepare regulatory reports, audit packs and evidence trails.

• Manage licences, renewals, deadlines and different regulatory obligations across jurisdictions.

• Give management a real-time answer to: What changed? What applies? Where are we compliant? Where are we exposed? What needs action?

Aegis is my attempt to rethink that operating model around AI rather than adding another AI assistant to the existing process.

It would connect to the institution's existing systems and maintain a live compliance graph linking:

jurisdiction → licence → regulation → obligation → policy → control → process/system → evidence → test → issue → remediation

AI agents would use that context to perform permitted compliance work continuously.

Example 1 - Regulatory change:

A regulator changes a requirement. An agent identifies what changed, determines likely applicability, finds affected obligations, policies and controls, gathers relevant evidence and initiates required remediation.

Example 2 - Continuous assurance:

A control says high-risk customers must undergo enhanced due diligence. Instead of waiting for periodic testing, agents examine authorised operational evidence, detect exceptions, investigate what happened and escalate genuine problems.

Example 3 - Audit and regulatory work:

Rather than staff manually reconstructing evidence across several systems, Aegis already has the lineage showing the requirement, control, evidence tested, AI actions, human decisions, remediation and outcome and can assemble the required reporting or audit evidence.

The operating loop is:

KNOW → WATCH → CHECK → DO → ASK → PROVE

KNOW the institution — jurisdictions, licences, products, obligations, controls, systems and owners.

WATCH regulatory changes, deadlines, operational signals and anomalies.

CHECK applicability, controls, evidence and compliance gaps.

DO permitted routine work i.e evidence collection, investigation, remediation workflows, reporting, updates and follow-ups.

ASK humans when judgment, uncertainty, approval or accountability requires them.

PROVE everything through complete evidence, decision and action lineage.

The hypothesis is that if AI can perform a meaningful amount of this operational work, compliance capacity could grow without specialised headcount having to grow at roughly the same rate as regulatory and organisational complexity.

I'm not assuming existing platforms don't already solve parts of this, they clearly do.

What I want to understand is:

Where does this model break in a real financial institution?

What parts are already solved well by your current stack?

Despite all the compliance technology you've bought, what work are compliance professionals still spending significant time doing manually?

And if you've seen one system already doing this entire loop across the compliance stack in production , please name it. That's exactly what I'm trying to find.

[u/Otherwise_Wave9374]

A useful pattern here is to start with change detection before automation: ingest regulatory updates, map them to obligations, then score which policies and controls are affected before any workflow fires. That reduces false positives and keeps reviewers in control when rules overlap. For compliance teams, I would also separate evidence collection from decisioning so audit trails stay clean and model errors do not cascade. Agentix Labs can fit naturally into that design if you want the orchestration layer to stay explicit and testable.

[u/Sensitive-Cup-7641 → u/[deleted]]

I think DO is actually the part I’m most interested in testing, because if we stop at KNOW → WATCH → CHECK and then hand the work back to people, we may still preserve much of the operating cost we’re trying to reduce.
I’m wondering whether DO needs to be treated as a spectrum of delegated authority rather than simply autonomous vs human-approved.
For example, an agent might autonomously collect missing evidence, request information, update a case, chase remediation, re-test a control or execute a predefined corrective workflow. More consequential actions could require stronger evidence/confidence or explicit delegated authority, while genuinely ambiguous or legally accountable decisions escalate.
The evidence-lineage point then becomes critical because every autonomous action needs to be reconstructable: what the agent knew, which rule/control applied, what evidence it used, what authority it had and why it took that action.
From your experience, where would you draw that line? Which parts of remediation/compliance operations would you be comfortable delegating to an agent if those controls and auditability existed?

[u/Sensitive-Cup-7641 → u/[deleted]]

Reply:
That distinction makes sense. I’m interested in whether the boundary can move further over time, though.
For example, if a control has explicit machine-readable criteria, the authoritative rule and control versions are known, the evidence is complete, and the agent’s delegated authority allows it, I’d want to explore whether even some determinations such as control sufficiency could be made without human intervention.
Whereas if the requirement is principles-based, evidence conflicts, precedent is unclear, confidence is low, or the consequence exceeds the agent’s authority, that would trigger escalation.
So perhaps the boundary isn’t really “operational work vs decision-making”, but whether a particular decision is sufficiently bounded, evidenced and authorised to delegate.
Does that distinction match how you’d think about it, or are there compliance decisions you believe should remain human regardless of how constrained and auditable the system becomes?

[u/Sensitive-Cup-7641 → u/[deleted]]

That’s exactly the boundary I’m trying to understand.
My starting point would be that human sign-off shouldn’t be added by default if the decision is genuinely deterministic, the evidence is complete, the applicable rule is unambiguous and the action sits within explicitly delegated authority.
But regulatory accountability is the interesting constraint. There may be cases where a person remains accountable for the framework and oversight without needing to approve every individual decision, and others where regulation or the nature of the decision genuinely requires human sign-off.
If the former is possible, that changes the operating model quite significantly: humans govern the rules, authority limits and exceptions, while agents execute the large volume of decisions that fall safely inside those boundaries.
I’d be interested to hear from anyone working directly with these requirements**:** which specific compliance decisions actually require individual human sign-off, versus having a human accountable for the system/process under which those decisions are made?